Android Security : Attacks and Defenses

Starting with an introduction to Android architecture and applications, this book covers security features and issues specific to the Android platform and applications--including possible attacks and the means to prevent them. It describes mobile devices pen-testing methodology and techniques for data leak prevention (DLP). The text also discusses advanced topics, including reverse engineering and forensics, malware analysis, and secure coding and hardening guidelines for Android. The book explains how to perform threat modeling for Android mobile devices/applications and incorporate them into enterprise SDLC processes. Android Attacks and Defenses is for anyone interested in learning about the strengths and weaknesses of the Android platform from a security perspective. Starting with an introduction to Android OS architecture and application programming, it will help readers get up to speed on the basics of the Android platform and its security issues. Explaining the Android security model and architecture, the book describes Android permissions, including Manifest permissions, to help readers analyze applications and understand permission requirements. It also rates the Android permissions based on security implications and covers JEB Decompiler. The authors describe how to write Android bots in JAVA and how to use reversing tools to decompile any Android application. They also cover the Android file system, including import directories and files, so readers can perform basic forensic analysis on file system and SD cards. The book includes access to a wealth of resources on its (http://www.androidinsecurity.com) www.androidinsecurity.com . It explains how to crack SecureApp.apk discussed in the text and also makes the application available on its site. The book includes coverage of advanced topics such as reverse engineering and forensics, mobile device pen-testing methodology, malware analysis, secure coding, and hardening guidelines for Android. It also explains how to analyze security implications for Android mobile devices/applications and incorporate them into enterprise SDLC processes. The books site includes a resource section where readers can access downloads for applications, tools created by users, and sample applications created by the authors under the Resource section. Readers can easily download the files and use them in conjunction with the text, wherever needed. Visit (http://www.androidinsecurity.com) www.androidinsecurity.com for more information. Annotation Android Security: Attacks and Defensesis for anyone interested in learning about the strengths and weaknesses of the Android platform from a security perspective. Starting with an introduction to Android OS architecture and application programming, it will help readers get up to speed on the basics of the Android platform and its security issues. Explaining the Android security model and architecture, the book describes Android permissions, including Manifest permissions, to help readers analyze applications and understand permission requirements. It also rates the Android permissions based on security implications and covers JEB Decompiler. The authors describe how to write Android bots in JAVA and how to use reversing tools to decompile any Android application. They also cover the Android file system, including import directories and files, so readers can perform basic forensic analysis on file system and SD cards. The book includes access to a wealth of resources on its website: www.androidinsecurity.com. It explains how to crack SecureApp.apk discussed in the text and also makes the application available on its site. The book includes coverage of advanced topics such as reverse engineering and forensics, mobile device pen-testing methodology, malware analysis, secure coding, and hardening guidelines for Android. It also explains how to analyze security implications for Android mobile devices/applications and incorporate them into enterprise SDLC processes. The book's site includes a resource section where readers can access downloads for applications, tools created by users, and sample applications created by the authors under the Resource section. Readers can easily download the files and use them in conjunction with the text, wherever needed. Visit www.androidinsecurity.com for more information Android Security: Attacks and Defenses is for anyone interested in learning about the strengths and weaknesses of the Android platform from a security perspective. Starting with an introduction to Android OS architecture and application programming, it will help readers get up to speed on the basics of the Android platform and its security issues. Explaining the Android security model and architecture, the book describes Android permissions, including Manifest permissions, to help readers analyze applications and understand permission requirements. It also rates the Android permissions based on security implications and covers JEB Decompiler. The authors describe how to write Android bots in JAVA and how to use reversing tools to decompile any Android application. They also cover the Android file system, including import directories and files, so readers can perform basic forensic analysis on file system and SD cards. The book includes access to a wealth of resources on its website: www.androidinsecurity.com. It explains how to crack SecureApp.apk discussed in the text and also makes the application available on its site. The book includes coverage of advanced topics such as reverse engineering and forensics, mobile device pen-testing methodology, malware analysis, secure coding, and hardening guidelines for Android. It also explains how to analyze security implications for Android mobile devices/applications and incorporate them into enterprise SDLC processes. The book’s site includes a resource section where readers can access downloads for applications, tools created by users, and sample applications created by the authors under the Resource section. Readers can easily download the files and use them in conjunction with the text, wherever needed. Visit www.androidinsecurity.com for more information. "Preface xvi Android Security: Attacks and Defenses Audience Our book is targeted at security architects, system administrators, enterprise SDLC managers, developers, white-hat hackers, penetration testers, IT architects, CIOs, students, and regular users. If you want to learn about Android security features, possible attacks and means to prevent them, you will find various chapters in this book as a useful starting point. Our goal is to provide readers with enough information so that they can quickly get up and running on Android, with all of the basics of the Android platform and related security issues under their belts. If you are an Android hacker, or if you are very well versed in security concerns of the platform, this book is not for you. Support Errata and support for this book are available on the CRC Press website and on our site: www.androidinsecurity.com. Our site will also have downloads for applications and tools created by the user. Sample applications created by the authors are available on our website under the Resource section. Readers should download apk files from our website and use them in conjunction with the text, wherever needed. Username: android Password: ISBN-10 number of the book--1439896461 Structure Our book is divided into 10 chapters. Chapter 1 provides an introduction to the mobile landscape. Chapters 2 and 3 introduce the reader to the Android OS and application architecture, respectively. Chapter 4 delves into Android security features. Chapters 5 through 9 cover various aspects of security for the Android platform and applications. The last chapter looks at the future landscape of threats. Appendixes A and B (found towards the end of the book) talk about the severity ratings of"-- Provided by publisher Introduction -- Android Architecture -- Android Application Architecture -- Android (in)security -- Pen Testing Android -- Reverse Engineering Android Applications -- Modifying The Behavior Of Android Applications Without Source Code -- Hacking Android -- Securing Android For The Enterprise Environment -- Browser Security And Future Threat Landscape. Abhishek Dubey, Anmol Misra.